Avatar | Bitcointalksearch.org

redsn0w

legendary

Activity: 1778

Merit: 1043

#Free market

Quote from: R2D221 on February 10, 2015, 01:41:55 PM

Quote from: redsn0w on February 10, 2015, 01:38:04 PM

I've find a great thread here in the forum : https://bitcointalksearch.org/topic/about-the-recent-attack-306878

Thanks, this is very helpful.

You are welcome, I hope to see again the possibility to upload Cheesy

or better use an avatar in the new forum software.

R2D221

hero member

Activity: 658

Merit: 500

Quote from: redsn0w on February 10, 2015, 01:38:04 PM

I've find a great thread here in the forum : https://bitcointalksearch.org/topic/about-the-recent-attack-306878

Thanks, this is very helpful.

hilariousandco

global moderator

Activity: 3990

Merit: 2717

Join the world-leading crypto sportsbook NOW!

Quote from: R2D221 on February 10, 2015, 01:36:32 PM

Quote from: krigger on February 10, 2015, 01:25:03 PM

Quote from: QuantumCurrency on February 06, 2015, 02:11:58 AM

What is the situation with being unable to change the profile avatar at this time?

I dont see why is it important at all?
Avatar is just a picture which represents nothing.
As it is a serioius forum I think that avatar is not good idea as anyone can upload picture by its own choice which can be rude, nude or sick. And banning a preson because of avatar is funny too. Thats why there is no avatar.

I have argued in other thread that avatars make easier to identify different people, since our brains process images faster than text.

This is true, though scammers could capitalise on this and that's why it might be a good idea limiting avatars to higher ranks than Newbies. NSFW avatars likely won't be allowed though.

redsn0w

legendary

Activity: 1778

Merit: 1043

#Free market

Quote from: R2D221 on February 10, 2015, 01:08:39 PM

Quote from: redsn0w on February 10, 2015, 01:07:33 PM

Quote from: R2D221 on February 10, 2015, 01:03:54 PM

Quote from: redsn0w on February 10, 2015, 12:50:40 PM

This is the payload :

https://gist.githubusercontent.com/super3/6802808/raw/4af8de8037a7079d30236c608e1247370849f585/gistfile1.txt

So, if I insert this file using an tag, will I get all these flashy things? I don't seem to understand.

No , I don't think. (I think)The hacker/s have inject the code into an image and after uploaded this image as avatar.

OK, but how was this “image” run, then?

I've find a great thread here in the forum : https://bitcointalksearch.org/topic/about-the-recent-attack-306878

R2D221

hero member

Activity: 658

Merit: 500

Quote from: krigger on February 10, 2015, 01:25:03 PM

Quote from: QuantumCurrency on February 06, 2015, 02:11:58 AM

What is the situation with being unable to change the profile avatar at this time?

I dont see why is it important at all?
Avatar is just a picture which represents nothing.
As it is a serioius forum I think that avatar is not good idea as anyone can upload picture by its own choice which can be rude, nude or sick. And banning a preson because of avatar is funny too. Thats why there is no avatar.

I have argued in other thread that avatars make easier to identify different people, since our brains process images faster than text.

krigger

sr. member

Activity: 518

Merit: 250

Presale is live!

Quote from: QuantumCurrency on February 06, 2015, 02:11:58 AM

What is the situation with being unable to change the profile avatar at this time?

I dont see why is it important at all?
Avatar is just a picture which represents nothing.
As it is a serioius forum I think that avatar is not good idea as anyone can upload picture by its own choice which can be rude, nude or sick. And banning a preson because of avatar is funny too. Thats why there is no avatar.

R2D221

hero member

Activity: 658

Merit: 500

Quote from: redsn0w on February 10, 2015, 01:07:33 PM

Quote from: R2D221 on February 10, 2015, 01:03:54 PM

Quote from: redsn0w on February 10, 2015, 12:50:40 PM

This is the payload :

https://gist.githubusercontent.com/super3/6802808/raw/4af8de8037a7079d30236c608e1247370849f585/gistfile1.txt

So, if I insert this file using an tag, will I get all these flashy things? I don't seem to understand.

No , I don't think. (I think)The hacker/s have inject the code into an image and after uploaded this image as avatar.

OK, but how was this “image” run, then?

redsn0w

legendary

Activity: 1778

Merit: 1043

#Free market

Quote from: R2D221 on February 10, 2015, 01:03:54 PM

Quote from: redsn0w on February 10, 2015, 12:50:40 PM

This is the payload :

https://gist.githubusercontent.com/super3/6802808/raw/4af8de8037a7079d30236c608e1247370849f585/gistfile1.txt

So, if I insert this file using an tag, will I get all these flashy things? I don't seem to understand.

No , I don't think. (I think)The hacker/s have inject the code into an image and after uploaded this image as avatar.

R2D221

hero member

Activity: 658

Merit: 500

Quote from: redsn0w on February 10, 2015, 12:50:40 PM

This is the payload :

https://gist.githubusercontent.com/super3/6802808/raw/4af8de8037a7079d30236c608e1247370849f585/gistfile1.txt

So, if I insert this file using an tag, will I get all these flashy things? I don't seem to understand.

redsn0w

legendary

Activity: 1778

Merit: 1043

#Free market

Quote from: R2D221 on February 10, 2015, 10:28:10 AM

Quote from: HeroC on February 06, 2015, 04:21:45 PM

The feature was removed due to an exploit involving avatars. Only older users (such as myself) have them.

Where can I see how that exploit worked? I'm interested because I don't want the same happening to me when I develop a web platform.

This is the payload :

https://gist.githubusercontent.com/super3/6802808/raw/4af8de8037a7079d30236c608e1247370849f585/gistfile1.txt

and this is the video :

https://www.youtube.com/watch?v=LKrOHAfMdxI

and here an article :

http://www.coindesk.com/bitcointalk-forum-hacked-hole-seekers/

R2D221

hero member

Activity: 658

Merit: 500

Quote from: HeroC on February 06, 2015, 04:21:45 PM

The feature was removed due to an exploit involving avatars. Only older users (such as myself) have them.

Where can I see how that exploit worked? I'm interested because I don't want the same happening to me when I develop a web platform.

fox19891989

hero member

Activity: 840

Merit: 1000

Quote from: u9y42 on February 06, 2015, 02:14:15 AM

Quote from: QuantumCurrency on February 06, 2015, 02:11:58 AM

What is the situation with being unable to change the profile avatar at this time?

Not only at this time, but for over a year - there was an exploit associated with it, so that feature was disabled. As soon as the new forum software is up and running, perhaps later this month, we should have that option back again.

Hmm, I wait for a long time, I hope they can update asap, I really need to change my avatar, I don't like my current one(feathercoin logo) Grin

bitkilo

legendary

Activity: 1638

Merit: 1010

https://www.bitcoin.com/

Quote from: hilariousandco on February 07, 2015, 06:13:01 AM

Think he's talking about this: https://bitcointalksearch.org/topic/how-to-get-an-avatar-on-the-forum-right-now-914176

Yes, just in your signature so not really an avatar though it is pretty cool.

Yep, thats the one.
I've read so many posts since then i guess i kinda got mixed up.
Still if ya desperate.

hilariousandco

global moderator

Activity: 3990

Merit: 2717

Join the world-leading crypto sportsbook NOW!

Think he's talking about this: https://bitcointalksearch.org/topic/how-to-get-an-avatar-on-the-forum-right-now-914176

Yes, just in your signature so not really an avatar though it is pretty cool.

redsn0w

legendary

Activity: 1778

Merit: 1043

#Free market

Quote from: bitkilo on February 07, 2015, 06:09:56 AM

There was a post i read not long ago where som member had written a code or similar that alowed users to modify it and then put that in there personal text spot.
After doing this you would have a piture where your personal text would be.
I will try find a link and edit this post, i do remember b!z did it and confirmed.

No you can put it only in the signature space, not in the personal message. This is the thread : https://bitcointalksearch.org/topic/how-to-get-an-avatar-914173

bitkilo

legendary

Activity: 1638

Merit: 1010

https://www.bitcoin.com/

There was a post i read not long ago where som member had written a code or similar that alowed users to modify it and then put that in there personal text spot.
After doing this you would have a piture where your personal text would be.
I will try find a link and edit this post, i do remember b!z did it and confirmed.

u9y42

legendary

Activity: 2562

Merit: 1071

Quote from: hilariousandco on February 07, 2015, 05:42:10 AM

I thought he was talking about just fixing it so avatars could be re-enabled.

Hmm, that was my impression as well.

I just went on to say that they did supposedly fix the issue, but that, in addition to the reasons you stated, they probably weren't really too sure everything was indeed working as intended, thus chose not to take the risk of re-enabling it - did I miss something? Cheesy

hilariousandco

global moderator

Activity: 3990

Merit: 2717

Join the world-leading crypto sportsbook NOW!

I thought he was talking about just fixing it so avatars could be re-enabled.

u9y42

legendary

Activity: 2562

Merit: 1071

Quote from: hilariousandco on February 07, 2015, 04:55:38 AM

Well it could but it was just decided not to bother for whatever reasons. Avatars aren't really a priority and they'll be back with the new forum anyway.

Quote from: arvindr on February 07, 2015, 04:32:16 AM

Can't a modification be made to the code to avoid that exploit ?

According to mprep, the code was indeed modified to avoid the exploit:

Quote from: mprep on July 21, 2014, 12:27:51 PM

Q: Why doesn't the forum let me add an avatar?
A: The forum was hacked some time ago. It is thought that the avatars were used as a means of injecting malicious code into the forum. Even though the vulnerability was patched, the avatars will be disabled until a new forum software is released.

He didn't go on to say why the feature was not re-enabled in that post but, perhaps that was not done out of concern there could be other related vulnerabilities, as well as that being a low priority feature and the work being put towards the new forum software instead, as hilariousandco mentioned.

hilariousandco

global moderator

Activity: 3990

Merit: 2717

Join the world-leading crypto sportsbook NOW!

Well it could but it was just decided not to bother for whatever reasons. Avatars aren't really a priority and they'll be back with the new forum anyway.

Topic: Avatar (Read 1875 times)